Hi,
I’m not an experienced Mikrotik admin (more of an enthusiast) an I would be grateful if members of this forum could help with pointing out where I went wrong when trying to improve my network with use of VLANS (nothing fancy for now, just VLAN for client devices and management VLAN).
First the outline of my test setup:
HEX PoE working as a router
hap ac lite working as bridge/switch
Audience serving as AP and bridge/switch (controlled by CAPsMAN in my actual non-test setup but I did not get as far in my tests)
All devices running RouterOS 7.16.2
I started with configuring HEX PoE and hap ac lite using switch configuration for hardware offloading as suggested here:
https://help.mikrotik.com/docs/spaces/ROS/pages/103841826/Basic+VLAN+switching#BasicVLANswitching-Otherdeviceswithabuilt-inswitchchip
This seems to be working fine with trunk, access and hybrid ports on both devices.
The real troubles started with configuring Audience.
First I realised that I can’t use the same setup method as above, as Audience doesn’t seem to have Switch menu in Winbox, and although I could configure ports and vlan table using terminal I could not finish the configuration by setting vlan-mode=secure. I found this and lack of Switch menu in Winbox strange as Atheros8327 chip on my Audience supports most of switch features (as confirmed in this link):
https://help.mikrotik.com/docs/spaces/ROS/pages/15302988/Switch+Chip+Features#SwitchChipFeatures-Introduction
Anyway, I thought that instead of pondering this, I’ll just drop hardware offloading as (unlike the other two devices) Audience has some resources to spare. I followed the below guide to configure a bridge with VLAN filtering:
https://help.mikrotik.com/docs/spaces/ROS/pages/28606465/Bridge+VLAN+Table
What I’m trying to do at this phase is to configure ether1 and ether2 in a bridge where ether1 is a trunk port with VLAN 10 and 90 tagged, and ether2 is a hubrid port with VLAN 90 tagged and 10 untagged.
Unfortunately I couldn’t get this to work and even though I can see some traffic on VALN 10 and 90 on ether1 I can’t even connect to Audience via Winbox other than through default VLAN 1. Audience can’t reach ntp server either.
This leads me to two questions:
- Is there a reason why switch configuration in not present on audience with RouterOS 7.16.2 even though it has capable switch chip?
- Where did I go wrong with the below bridge filtering configuration?
# 1970-01-02 01:31:31 by RouterOS 7.16.2
# software id = 4XZX-9Q65
#
# model = RBD25G-5HPacQD2HPnD
# serial number = D5840DBC5A69
/interface bridge
add name=bridge-lan vlan-filtering=yes
/interface wireless
# managed by CAPsMAN
set [ find default-name=wlan1 ] ssid=MikroTik
# managed by CAPsMAN
set [ find default-name=wlan2 ] ssid=MikroTik
set [ find default-name=wlan3 ] ssid=MikroTik
/interface vlan
add interface=bridge-lan name=MGMT vlan-id=90
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=bridge-lan interface=ether1
add bridge=bridge-lan interface=ether2
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface bridge vlan
add bridge=bridge-lan tagged=ether1 untagged=ether2 vlan-ids=10
add bridge=bridge-lan tagged=bridge-lan,ether2,ether1 vlan-ids=90
/interface wireless cap
#
set bridge=*7 caps-man-addresses=192.168.90.1 enabled=yes interfaces=\
wlan2,wlan1
/ip address
add address=192.168.90.6/24 interface=MGMT network=192.168.90.0
/ip dhcp-client
add interface=MGMT
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=IAS-WIFI-2
/system note
set show-at-login=no
/system ntp client servers
add address=192.168.90.1
/system routerboard settings
set auto-upgrade=yes
/tool mac-server
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
I’d appreciate any help and I appreciate that I most likely did something dumb and I just can’t see it yet.
) is use of CAPsMAN. As I said I didn’t get as far as even establishing connection with the HEX PoE router where the CAPsMAN is.
